Adlumin Q3 2026: sharper detection, faster response, earlier ransomware warnings

TL; DR: Attackers do not always break in. They can log in and blend in. Q3 2026 builds on Adlumin’s 24/7 MDR with AI-powered detections that learn what normal looks like in each environment, automated Google Workspace account response, Incident Response for MSPs, and Cove backup signals in security monitoring (limited preview).

It is 2:00 a.m. and an alert fires. Maybe you lead a small IT team at a growing mid-market company. Maybe you run an MSP protecting dozens of clients. Either way, nobody is at the console, and by morning someone will ask what happened.

Attackers count on that. They use trusted tools, hijack legitimate sessions, and target backups because those moves look like normal activity. Alert volume grows. Headcount rarely does.

This is the moment N-able Adlumin MDR is built for: 24/7 continuous response that combines expert-led triage and mitigation with automation and AI, acting on your behalf with every action logged and available for review. Q3 2026 builds on that proven foundation with one goal: less work between a threat and a resolved incident.

The impact in numbers

Adlumin continues to expand its scale through AI analytics, helping the SOC respond faster and more consistently while freeing experts to focus on threats requiring human judgment.

Less noise, more certainty

Threat behavior evolves, making detection and response coverage a continuous journey. Adlumin continues to invest in AI-enhanced detections that learn what normal looks like for each environment and user:

• Anomalous Process Execution flags living-off-the-land activity and adds AI command-line analysis for faster verdicts.
• M365 Session Hijacking detection expands coverage for attackers who use VPNs or anonymizers to appear local, while filtering out 99% of legitimate multi-login sessions.
• DNS Threat Detection flags unusual DNS behavior and explains what changed.
• Adaptive Brute Force Protection sets thresholds per user and tenant, starting with failed Windows logons.

What you get: expanded detection coverage, fewer false positives, and faster verdicts on the threats that matter.

Response that does not wait for morning

Detection is only half the job. Adlumin’s SOC acts on your behalf, and Q3 extends those response capabilities.

Google Workspace identity response: When a custom detection fires, Adlumin can automatically disable or re-enable an account or reset its password, with a full audit trail. This brings Google Workplace response capabilities in line with those already available for Microsoft 365 environments.

Natural Language Research (limited preview) lets analysts search logs in plain English, alongside Lucene queries, helping speed up investigations.

Expert depth when the stakes are highest

Most threats are handled within Adlumin MDR. For critical requiring deeper investigation and coordinated recovery, the Incident Response (IR) Service provides response leadership, and a clear remediation plan. IR is now available to MSPs as an add-on to Adlumin MDR, as well as to internal IT teams. Service targets for confirmed P1 incidents:

• P1 acknowledgment within 15 minutes
• Cyber Incident Room opened within 30 minutes
• P1 recommendations delivered within one hour

IR is purchased in hourly blocks, as a proactive retainer or during an active incident, so you can plan or get help when you need it.

Early warning from your backups

Backups are your path to recovery, which is why attackers often target them. The Cove Backup integration (limited preview) streams Cove telemetry into Adlumin with no per-tenant syslog to configure, watching for backup and restore failures, configuration changes, and unusual backup behavior.

Adlumin correlates these signals with the rest of your security data and raises a ticket, bringing backup risk into the same response workflow without adding another console to monitor.

Connect Adlumin to the tools you already use

The new Developer Portal gives every API endpoint a live « Try it » button and a readable OpenAPI specification, so technicians can test real calls quickly.

The MCP Server connects MCP-compatible AI assistants, such as Claude or GitHub Copilot, to Adlumin through thirteen tools spanning detections, Active Directory risk, endpoints, network health, compliance, and firewall events. Ask for unacknowledged critical detections from the last 24 hours and get the answer without opening the portal.

Self-service tenant onboarding lets you create tenants in the console, with the region set automatically and no support ticket required. Tags by vertical and geography speed up filtering, reporting, and exports.

Please note: the MCP Server is built and maintained by the N-able’s Head NERD team and is not supported by N-able Support. For questions or issues, use the contact details in the MCP Server Start Guide on the N-able Developer Portal.

What comes next

A Tenant API is planned for Q4 2026, designed to help MSPs manage tenants from their own provisioning tools. Adlumin also plans to move the Cove Backup integration and Natural Language Research toward general availability. Roadmap items are forward-looking and subject to change.

The morning after

Back to that 2:00 a.m. alert. AI-enhanced analytics help separate signals from noise. Adlumin’s SOC triages and acts. Compromised accounts can be contained automatically, and IR experts can step in if an incident turns critical. By morning, you have a clear record of what happened, what was done, and what, if anything, still needs you. Security operations that work around the clock for your organization or every client you protect.

Where to go from here: watch the Adlumin Q3 release notes video, or talk to your N-able account team about the IR add-on and the Cove Backup integration preview.

FAQ

How is the IR Service different from MDR?
Adlumin MDR provides 24/7 continuous response, combining expert-led triage and mitigation with automation and AI to handle most threats on your behalf. The IR Service is an add-on for critical incidents, adding deeper investigation, response leadership, and a plan to address the root cause.